Skip to content
Hermes Codex

CVE-2026-93952: Arista VeloCloud Orchestrator Authentication Bypass and Remote Code Execution

HERMES

HERMES THREAT SCORE & ENTERPRISE RISK EXPOSURE

Target: SD-WAN Orchestration Control Plane & Multi-Branch AI Edge Routing
Confidence: 98%
98 / 100
EXTREME

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 20 / 20
Weaponization 20 / 20
Exposure 19 / 20
Prevalence 18 / 20
Impact 20 / 20
Exploit Maturity 20 / 20
Attack Chain Potential 19 / 20
⚖️ Divergence & Operational Rationale

CVSS v3.1 scores CVE-2026-93952 at 10.0 Critical with scope expansion (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Hermes Threat Score assesses this vulnerability at 98 (EXTREME) to mirror its active in-the-wild exploitation cataloged in the CISA KEV list on September 22, 2026. As the central management brain for enterprise SD-WAN overlays, compromise of the on-premises VeloCloud Orchestrator grants adversaries unconstrained command dispatch and traffic redirection across all connected branch office edge appliances.

HASS

HASS AGENTIC SEVERITY & PERIMETER BOUNDARY IMPACT

Target: SD-WAN Orchestration Control Plane & Multi-Branch AI Edge Routing
Confidence: 95%
65 / 100
MODERATE

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown
Autonomy 15 / 20
Tool Access 16 / 20
Privilege 14 / 15
Persistence 13 / 15
External Impact 13 / 15
Propagation 13 / 15
⚖️ Divergence & Operational Rationale

While primarily an enterprise network management vulnerability, VCO governs the transit topology and telemetry collection for branch AI inference clusters and private MCP interconnects. Compromise of the orchestrator permits silent interception, DNS redirection, and MITM alteration of agentic tool traffic across distributed corporate perimeters.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-93952: Arista VeloCloud Orchestrator Authentication Bypass and Remote Code ExecutionVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTArista VeloCloud Orchestrator
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Arista VeloCloud Orchestrator documented in Hermes dossier.”

Supporting Verified Evidence:

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”

VCO is deployed on-premises as a clustered appliance or virtual machine image (Debian/Ubuntu Linux base) running an NGINX reverse proxy, a Node.js/Java API gateway service, and a relational database backend (MySQL). It terminates management tunnels and REST APIs from distributed SD-WAN edge nodes.

ParameterTechnical SpecificationOperational Impact
CVE IdentifierCVE-2026-93952Arista Advisory 0183 / CISA KEV Catalog Entry
Vulnerability ClassImproper Input Validation (CWE-20) / Auth Bypass (CWE-287)Client-side HTTP header spoofing bypassing reverse proxy trust
Vulnerable ComponentVCO Web API Dispatcher & Gateway (/portal/rest/edge/)Ingress request filter parsing mTLS client certificate headers
Exploitation VectorDirect HTTP POST with forged internal routing headersUnauthenticated execution of internal diagnostic shell endpoints
Privileges RequiredNone (PR:N)Attacker sends requests to TCP 443 on on-premises VCO instances
Privileges ObtainedRoot / Operator on Orchestrator Host (uid=0)Unrestricted OS command execution and full SD-WAN fabric control
Affected VersionsVeloCloud Orchestrator 5.2.x < 5.2.3.16, 6.1.x < 6.1.3.8, 6.4.x < 6.4.2.8, 7.0.x < 7.0.0.3On-premises deployments only (Cloud-hosted SaaS patched prior)
Fixed VersionsVCO 5.2.3.16, 6.1.3.8, 6.4.2.8, 7.0.0.3Enforces reverse proxy header stripping and strict mTLS verification

2. Vulnerability Anatomy & Root Cause Analysis

Section titled “2. Vulnerability Anatomy & Root Cause Analysis”

Untrusted Forwarded Header Injection in Reverse Proxy Dispatch

Section titled “Untrusted Forwarded Header Injection in Reverse Proxy Dispatch”

The flaw resides in the reverse proxy and API request dispatch module within on-premises VCO. When Edge routers connect to /portal/rest/edge/, the gateway parses mutual TLS certificate metadata from client HTTP headers (X-Client-Cert-SHA1, X-Gateway-Identity, X-VCO-Internal-Route) forward-propagated by internal routing layers.

Because the edge gateway failed to sanitize or overwrite these headers when received directly over public external interfaces, an attacker can spoof internal proxy metadata:

// Vulnerable dispatch logic in VCO API Gateway
function authenticateEdgeRequest(req: Request, res: Response, next: NextFunction) {
    const edgeFingerprint = req.headers['x-edge-fingerprint'] || extractCertFingerprint(req);
    const internalBypassToken = req.headers['x-vco-internal-route'];


    // VULNERABILITY: Header spoofing allows unauthenticated requests to claim internal edge status
    if (internalBypassToken === 'vco-cluster-trust' || isValidFingerprint(edgeFingerprint)) {
        req.userRole = 'EDGE_ADMINISTRATOR';
        return next();
    }
    return res.status(401).json({ error: 'Authentication required' });
}

Once elevated to EDGE_ADMINISTRATOR, the attacker targets internal diagnostic and configuration endpoints (such as /portal/rest/edge/diag/executeShell), which directly invoke administrative bash commands via child_process.exec() without argument escaping or verification.

3. Attack Vectors & Forensic Execution Flow

Section titled “3. Attack Vectors & Forensic Execution Flow”
sequenceDiagram
    autonumber
    actor Attacker as Remote Attacker
    participant Proxy as VCO Ingress / NGINX Proxy
    participant Gateway as VCO API Gateway Service
    participant Diag as Diagnostic Controller (executeShell)
    participant Host as Linux Appliance Host (Root)
    participant Edges as Managed SD-WAN Edges


    Attacker->>Proxy: POST /portal/rest/edge/diag/executeShell (TCP 443)
    Note over Proxy: Headers contain X-VCO-Internal-Route: vco-cluster-trust
    Proxy->>Gateway: Forward request without stripping internal headers
    Note over Gateway: Auth filter detects trusted header -> Grants EDGE_ADMINISTRATOR
    Gateway->>Diag: Dispatch payload to diagnostic execution engine
    Diag->>Host: Execute arbitrary OS commands via child_process.exec()
    Host-->>Attacker: Interactive root shell / payload execution
    Host->>Edges: Push rogue routing updates / backdoored firmware configs
  1. Perimeter Reconnaissance & Ingress Probe: The threat actor identifies an on-premises Arista VeloCloud Orchestrator instance exposed on port TCP 443 via perimeter scans or targeted intelligence.
  2. Forged Routing Header Injection: The attacker transmits an HTTP POST request targeting /portal/rest/edge/diag/executeShell, inserting spoofed internal proxy headers (X-VCO-Internal-Route: vco-cluster-trust and X-Edge-Fingerprint: trusted-internal-orchestrator).
  3. Authentication Filter Bypass: The VCO API Gateway evaluates the spoofed headers, incorrectly determines the request originated from an internal trusted cluster node, and grants elevated EDGE_ADMINISTRATOR privileges.
  4. Arbitrary Command Execution on Host: The diagnostic controller unpacks the JSON payload and executes the embedded bash command with root/operator privileges on the Linux underlying host.
  5. Lateral Propagation Across SD-WAN Edges: Leveraging root control over the central orchestrator database and management plane, the adversary pushes compromised firmware, rogue BGP/OSPF routing configurations, or traffic redirection policies to all enrolled remote Edge routers.

4. Forensic Investigation & Incident Response

Section titled “4. Forensic Investigation & Incident Response”

Security operations and DFIR teams investigating potential compromise of Arista VeloCloud Orchestrator instances should execute the following forensic triage actions:

Appliance Triage & Verification Commands

Section titled “Appliance Triage & Verification Commands”
Terminal window
# 1. Audit NGINX access logs for spoofed internal header artifacts
grep -E "X-VCO-Internal-Route|vco-cluster-trust" /var/log/nginx/access.log


# 2. Inspect orchestrator service logs for diagnostic shell invocations
grep -E "executeShell|portal/rest/edge/diag" /var/log/velocloud/orchestrator.log


# 3. Check for unauthorized child processes spawned under velocloud or root
ps auxf | grep -E "velocloud.*bash|node.*executeShell|sh -c"


# 4. Identify rogue outbound connections established from the VCO host
ss -tulpen | grep -E "ESTAB.*(4444|9001|8080|1337)"


# 5. Check integrity of edge configuration databases and firmware bundles
find /var/lib/velocloud/firmware/ -type f -mtime -7 -ls

5. Threat Hunting & Detection Engineering

Section titled “5. Threat Hunting & Detection Engineering”

Deploy detection logic across both network boundary sensors and host audit logs to detect header spoofing and suspicious diagnostic executions:

title: Arista VeloCloud Orchestrator Header Spoofing and Diagnostic Shell Invocation
id: 93952a01-vco-4912-arista-authbypass01
status: critical
description: Detects unauthorized invocation of VCO Edge diagnostic API endpoints using spoofed internal cluster headers.
author: Hermes Codex Detection Engineering
date: 2026-09-22
logsource:
  category: webserver
  product: velocloud_orchestrator
detection:
  selection_headers:
    cs-method: 'POST'
    cs-uri-stem|startswith:
      - '/portal/rest/edge/diag/'
      - '/portal/rest/edge/debug/'
    c-header|contains:
      - 'X-VCO-Internal-Route'
      - 'vco-cluster-trust'
  selection_source:
    c-ip|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection_headers and not selection_source
falsepositives:
  - Legitimate edge appliances with validated mTLS sessions terminating on designated edge ports.
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-93952

6. Remediation & Hardening Roadmap

Section titled “6. Remediation & Hardening Roadmap”

Official Security Updates

Section titled “Official Security Updates”

Apply the vendor security updates immediately as detailed in Arista Advisory 0183:

  • Upgrade 5.2.x deployments to 5.2.3.16 or later.
  • Upgrade 6.1.x deployments to 6.1.3.8 or later.
  • Upgrade 6.4.x deployments to 6.4.2.8 or later.
  • Upgrade 7.0.x deployments to 7.0.0.3 or later.

Temporary Workarounds & Defensive Hardening

Section titled “Temporary Workarounds & Defensive Hardening”
  1. Perimeter Network Filtering: Restrict access to the VCO web interface (TCP 443) exclusively to trusted management subnets and jump-hosts; do not expose on public Internet interfaces.
  2. Reverse Proxy Sanitization: If operating behind an external WAF, load balancer, or reverse proxy, configure strict rules to strip incoming client headers containing X-VCO-* and X-Edge-*.
  3. Administrative Access Review: Rotate all internal VCO cluster credentials, API tokens, and Edge appliance enrollment keys if unauthenticated requests to /portal/rest/edge/diag/ are identified in access logs.

7. Correlated Research & Internal References

Section titled “7. Correlated Research & Internal References”

Sources & References

Section titled “Sources & References”